VMs don't get anything beyond major security updates by default. Many project owners would like to have their VMs get regular updates. How should that happen?
This task is done when recommended practices are recorded somewhere on wikitech
Questions:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | None | T168478 Keep wmflabs scoring boxes up-to-date | |||
| Open | None | T169247 Document recommended process for installing vendor provided package upgrades in Wikimedia VPS |
I'd like to see a puppet class that is enabled by default that sets up a cron job to run apt-get updates.
It seems to me this should be enabled by default so dummies like me don't forget to enable it. ;)
Looks like the cron strategy is recommended practice. https://help.ubuntu.com/community/AutomaticSecurityUpdates
The unattended-upgrades apt-get package provides some functionality for specifying what types of packages will be upgraded and which ones won't.
Labs used to have unattended-upgrades install fleet-wide, not sure what happened with that. It may be that it was disabled because they can cause issues where packages you care about install and restart the underlying service (I'm just guessing). However, not that they're not protecting you necessarily: in many cases you have to restart individual services and in some cases /all/ services or reboot, in the cases of e.g. a libc6 or kernel vulnerability. And then there's all the other stuff that people may run on their VM (pip/npm/etc.)
@aborrero Is this something that you could try to document for project maintainers? I think this is closely related to your work on T181647: create 'attended' upgrade workflow for cloud with Toolforge as canonical case, https://wikitech.wikimedia.org/wiki/Portal:Cloud_VPS/Admin/Managing_package_upgrades, and https://wikitech.wikimedia.org/wiki/Apt-upgrade.
The result could live under https://wikitech.wikimedia.org/wiki/Help:Instances#Managing_Instances or at least be linked to from there.